The audit logfile is in json format, which you can filter with jq.
Read → this ← or → this ← for some inspiration.
Much and good luck, ernolf